From: Stefan Schantl <stefan.schantl@ipfire.org>
Date: Fri, 5 Apr 2024 19:26:39 +0000 (+0200)
Subject: suricata: Enable landlock security feature
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=64e057aaa5ac0eb45094773709e481b535891ec4;p=people%2Fstevee%2Fipfire-2.x.git

suricata: Enable landlock security feature

This will limit the suricata process to only read and write to a certain
files/directories.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index 165a2442d..dd6a42e91 100644
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -768,16 +768,16 @@ security:
   limit-noproc: true
   # Use landlock security module under Linux
   landlock:
-    enabled: no
+    enabled: yes
     directories:
-      #write:
-      #  - @e_rundir@
+      write:
+        - /run
       # /usr and /etc folders are added to read list to allow
       # file magic to be used.
       read:
-        - /usr/
-        - /etc/
-        - @e_sysconfdir@
+        - /usr/share/misc/magic.mgc
+        - /var/ipfire/suricata/
+        - /var/lib/suricata/rules/
 
   lua:
     # Allow Lua rules. Disabled by default.